Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google can track surfing habits without need for HTTP cookies

youbroketheinternet.org

Post reply on HN
Print view View original

51–60 of 65 posts

Re: Google can track surfing habits without need for HTTP cookies

#51

Post by Engineering-MD »

lixtra wrote: post #37
manicdee wrote: post #35

Earlier quoted context omitted.

A four byte hash is unique to two billion sites. The collision space with non-mainstream sites you might visit is going to be tiny. It’s as good as sending the actual URL, and possibly even the full path to the document you requested, if the browser has previously asked Google for another site and Google has seen a pattern of browsing from Site A to Site B in browsers not using this “security” feature.

> A four byte hash is unique to two billion sites Due to the birthday paradox collisions happen much earlier.

Yes, but that is (by the nature of the paradox) only true for a small subset of sites. It provides a huge amount of information, and for much the same reason, DoB is often used as part of an identifier.

Re: Google can track surfing habits without need for HTTP cookies

#52

Post by auslander »

marichards wrote: post #49
judge2020 wrote: post #24

Earlier quoted context omitted.

I don't see ISPs starting DOH servers up within the next 5 years, so either way, you'll be performing dns lookups to a central server.

I'm under the impression Firefox intends to do DOH with Cloudflare shortly. Does this allow Cloudflare to tie together user sessions to different HTTPS domains? If X and Y are Cloudflare fronted domains, can they now pair sessions? I'm guessing a DOH session queries for domain X and immediately an HTTPS connection appears for X, then queries for Y and another appears at Y. Then the whole DOH session becomes identifia…

Cloudflare is not as bad as it looks. It is much worse :)

As a reverse proxy, it strips SSL, in fact MITMs your traffic. All your data is in plaintext to Cloudflare, which leaks not only history, but also logins/passwords, IPs, credit card numbers, coin wallets, everything.

I don't see obvious solution today for DNS queries be private. Pointing your system to Google or Cloudflare DNS is plainly giving away your browsing history, for free, DOH (dns over https) or not. As of today, all my devices are using always-on VPN, and using my VPN provider's DNS.

Re: Google can track surfing habits without need for HTTP cookies

#53

Post by oliwarner »

corv wrote: post #29
aawc wrote: post #11

Did you turn on that 'Block dangerous and deceptive content' feature in Firefox' security tab? It works by consulting Google each time you visit a new website. You can imagine the rest. Patently wrong. Here's how the API works: The Update API lets your client applications download hashed versions of the Safe Browsing lists for storage in a local database. URLs can then be checked locally. Only if a match is found in…

You’re right, it doesn’t contact Google every time but it does contact Google periodically, something which many users might not be aware of. Ideally Firefox wouldn’t rely on contacting any third parties in their default browser configuration.

No, there's a substantive difference between "contacts Google to run a check on a specific domain" and "contacts Google to update the local database of bad domains". They're not comparable.

And a browser that doesn't contact third parties isn't much of a browser.

Re: Google can track surfing habits without need for HTTP cookies

#54

Post by [deleted] »

auslander wrote: post #50
stubish wrote: post #48

Earlier quoted context omitted.

Google does not need to track anyone. Google needs to sell ads, and Google needs to be perceived as the best place to spend your advertising budged. What business case is there for Google to work hard at tracking people, defeating anti-tracking measures? There is a cost to doing that, and I don't see a financial incentive for doing it. There are certainly business cases for Google to not defeat anti-tracking measures…

Keyword is targeted ads, it revolutionised the market and made FB and Google rich. The only way to sell an ad placement to white males, with >100k income, in this zip code, with specific health problem is to track those people, and Google tracks them all. FB gets data from your posts and messages, Google gets it from your emails, files, searches, location. Both get data from your browsing history (Like buttons, G-Ana…

[deleted]

Re: Google can track surfing habits without need for HTTP cookies

#55

Post by auslander »

stubish wrote: post #48
auslander wrote: post #31

Earlier quoted context omitted.

> ... if it wanted to Made me smile. Google needs to track you, its their core business model. Defeat is not an option, all methods should be found and blocked. Thankfully Chrome is not the only usable browser, and network requests are detectable.

Google does not need to track anyone. Google needs to sell ads, and Google needs to be perceived as the best place to spend your advertising budged. What business case is there for Google to work hard at tracking people, defeating anti-tracking measures? There is a cost to doing that, and I don't see a financial incentive for doing it. There are certainly business cases for Google to not defeat anti-tracking measures…

All of them use your IP address as major identifier (4). UnGoogling Guide, v0.1 :)

1. Switch everything to Apple, hardware company. iPhone, Mac OS

2. Use myname@icloud.com email, create few email aliases. Forward your gmail to it, and finally delete gmail accounts.

3. Don't use any of Googles software, like Chrome. Install adbocker extention/app and use Private Browsing windows by default

4. Buy a VPN subscription and set up your phone and Mac to always use it (on-demand).

Re: Google can track surfing habits without need for HTTP cookies

#56

Post by auslander »

auslander wrote: post #55
stubish wrote: post #48

Earlier quoted context omitted.

Google does not need to track anyone. Google needs to sell ads, and Google needs to be perceived as the best place to spend your advertising budged. What business case is there for Google to work hard at tracking people, defeating anti-tracking measures? There is a cost to doing that, and I don't see a financial incentive for doing it. There are certainly business cases for Google to not defeat anti-tracking measures…

All of them use your IP address as major identifier (4). UnGoogling Guide, v0.1 :) 1. Switch everything to Apple, hardware company. iPhone, Mac OS 2. Use myname@icloud.com email, create few email aliases. Forward your gmail to it, and finally delete gmail accounts. 3. Don't use any of Googles software, like Chrome. Install adbocker extention/app and use Private Browsing windows by default 4. Buy a VPN subscription an…

(4) Gmail and Facebook will complain that you're logging in from 'unknown device', meaning not from IP they recorded on you. Set up MFA to get around it, like FreeOTP mobile app to generate codes.

Re: Google can track surfing habits without need for HTTP cookies

#57

Post by bogomipz »

toast0 wrote: post #30
bogomipz wrote: post #6

The author states: >"Eight years later, everyone in the business seems keen to point out that TLS version 1.3 will finally address this issue by encrypting session data, although it isn't obvious if the measures taken by IETF actually work." Can someone say why it not yet if the measure taken by the IETF in TLS 1.3 work? Is it simply that this part of the spec hasn't been finalized yet? Or does the author mean someth…

So, TLS 1.2 servers offer session identifiers in cleartext and client resumption sends them in cleartext also. Which probably means someone watching lots of traffic to Google can correlate users even as they move across ips. TLS 1.3 servers send the session identifiers encrypted to the client, and then the client sends it back in cleartext, but each successful handshake will generate a new identifier; a passive obser…

Thanks for the clear explanation. Would it not have been more accurate for the author to have stated then that "the measures taken by the IETF in TLS 1.3 will work, although with some caveats"?

Re: Google can track surfing habits without need for HTTP cookies

#58

Post by cromwellian »

auslander wrote: post #50
stubish wrote: post #48

Earlier quoted context omitted.

Google does not need to track anyone. Google needs to sell ads, and Google needs to be perceived as the best place to spend your advertising budged. What business case is there for Google to work hard at tracking people, defeating anti-tracking measures? There is a cost to doing that, and I don't see a financial incentive for doing it. There are certainly business cases for Google to not defeat anti-tracking measures…

Keyword is targeted ads, it revolutionised the market and made FB and Google rich. The only way to sell an ad placement to white males, with >100k income, in this zip code, with specific health problem is to track those people, and Google tracks them all. FB gets data from your posts and messages, Google gets it from your emails, files, searches, location. Both get data from your browsing history (Like buttons, G-Ana…

Google makes most of their money from AdWords which is keyword targeted advertising buy and large.

People way overestimate the helpfulness of profile targeted advertising vs search term targeted ads.

Re: Google can track surfing habits without need for HTTP cookies

#59

Post by auslander »

cromwellian wrote: post #58
auslander wrote: post #50

Earlier quoted context omitted.

Keyword is targeted ads, it revolutionised the market and made FB and Google rich. The only way to sell an ad placement to white males, with >100k income, in this zip code, with specific health problem is to track those people, and Google tracks them all. FB gets data from your posts and messages, Google gets it from your emails, files, searches, location. Both get data from your browsing history (Like buttons, G-Ana…

Google makes most of their money from AdWords which is keyword targeted advertising buy and large. People way overestimate the helpfulness of profile targeted advertising vs search term targeted ads.

Without real numbers, like AdWords vs Profile Ads, one has to rely on common sense, in my sense, profiling is a gold mine. Below is a random quote I Googled up :)

In practice, this means that Google can now, if it wanted to, build up even richer profiles of named individuals’ online activity. It also means that the DoubleClick ads that follow people on the web could be personalized based on the keywords that individuals use in Gmail.

https://www.theguardian.com/technology/2016/oct/21/how-to-di...

What about Adwords Customer Match, identity-based targeting ? (updated in 2018, by Erin Sagin is the Global SMB Solutions Go To Market Lead at Google) https://www.wordstream.com/blog/ws/2015/11/02/adwords-custom...

Re: Google can track surfing habits without need for HTTP cookies

#60

Post by toast0 »

bogomipz wrote: post #57
toast0 wrote: post #30

Earlier quoted context omitted.

So, TLS 1.2 servers offer session identifiers in cleartext and client resumption sends them in cleartext also. Which probably means someone watching lots of traffic to Google can correlate users even as they move across ips. TLS 1.3 servers send the session identifiers encrypted to the client, and then the client sends it back in cleartext, but each successful handshake will generate a new identifier; a passive obser…

Thanks for the clear explanation. Would it not have been more accurate for the author to have stated then that "the measures taken by the IETF in TLS 1.3 will work, although with some caveats"?

I must admit that I had only skimmed the article, and hadn't read the bit about TLS 1.3, until after it was edited. I agree with what it says now :D
Post reply on HN